Limit Mojo messages recursion depth

mojo/public/tools/bindings/generators/cpp_templates/struct_definition.tmpl

 {%- import "validation_macros.tmpl" as validation_macros %}
 {%- set class_name = struct.name ~ "_Data" %}
 
 // static
 bool {{class_name}}::Validate(
     const void* data,
     mojo::internal::ValidationContext* validation_context) {
+  mojo::internal::ValidationContext::ScopedDepthTracker depth_tracker(

[yzshen1, 2016/09/06 17:03:10]

This is not the only place: we need to consider things like:

EXAMPLE:
Union A {
  B b;
};

Struct B {
  A a;
};

EXAMPLE 2:
Struct A {
  array<array<array<A>>> a;
};

This will result in a 4-time deeper stack than we expect.


I think the best place to insert these checks is probably in validation_util.h:
- ValidateContainer
- ValidateStruct
- Validate{Inlined, NonInlined}Union

What do you think?

[tibell, 2016/09/07 05:41:20]

Done.

I was aware of this. The reason I didn't do it for unions etc is that an
attacker can only increase the recursion depth by a small constant factor,
dependent on the message definition rather than the runtime message, even if we
don't check unions/arrays/maps (unless unions can be recursive?). The limit
(100) times the stack frame size is still quite small compare to e.g. a O(1MB)
total stack size limit.

In either case, it's cleaner to do it everywhere and the functions you listed
above gives us a nice place to do so.

+      validation_context);
+  if (validation_context->ExceedsMaxDepth()) {
+    ReportValidationError(
+        validation_context,
+        mojo::internal::VALIDATION_ERROR_MAX_RECURSION_DEPTH);
+    return false;
+  }
+
   if (!data)
     return true;
 
   if (!ValidateStructHeaderAndClaimMemory(data, validation_context))
     return false;
 
   // NOTE: The memory backing |object| may be smaller than |sizeof(*object)| if
   // the message comes from an older version.
   const {{class_name}}* object = static_cast<const {{class_name}}*>(data);
 
@@ skipping 43 matching lines @@
     return true;
 {%-     endif %}
 {%-     set field_expr = "object->" ~ packed_field.field.name %}
 {{validation_macros.validate_field(packed_field.field, field_expr, struct.name, true)}}
 {%-   endif %}
 {%- endfor %}
 
   return true;
 }